CVE-2021-3325: Critical severity Fibranet Monitorix vulnerability
Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hostsdeny option). This issue occurred because a new access-control feature was introduced without considering that some exiting installations became unsafe, upon an update to 3.13.0, unless the new feature was immediately configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Monitorix after upgrading to 3.13.0, immediately configure the hosts_deny option to prevent remote attackers from bypassing Basic Authentication in a default installation.
Monitorix hosts_deny option = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2021-3325?
CVE-2021-3325 is classified as a medium severity vulnerability due to its ability to bypass Basic Authentication.
How do I fix CVE-2021-3325?
To fix CVE-2021-3325, upgrade Monitorix to version 3.13.1 or later, which addresses the authentication bypass issue.
What software is affected by CVE-2021-3325?
CVE-2021-3325 affects Monitorix version 3.13.0 and certain installations of Fedora 32 and 33.
Can CVE-2021-3325 be exploited remotely?
Yes, CVE-2021-3325 can be exploited by remote attackers who can bypass Basic Authentication.
Is there a configuration vulnerability associated with CVE-2021-3325?
Yes, CVE-2021-3325 arises from a misconfiguration in installations that lack a hosts_deny option.